dominus-sdk-nodejs 11.0.2 → 11.0.5

package/docs/agent-guide/2026-06-27-0849-sdk-orient/00-reading-order.md

@@ -1,35 +1,35 @@
-# 00 Reading Order
-
-Snapshot: 2026-06-27-0849-sdk-orient. Source-backed at SDK v6.6.0, branch
-`production`. Code is authority; this guide is a map.
-
-## Read These First (docs)
-
-1. This pack, in INDEX order.
-2. `docs/architecture.md` — request lifecycle, layering, Two-Layer Storage Rule.
-3. `docs/routes-services.md` — service/endpoint matrix and route-prefix mapping.
-4. `docs/usage-reference.md` — exhaustive per-command reference (large; grep it,
-   do not read top-to-bottom).
-5. `CLAUDE.md` — repo conventions and the public-API change checklist.
-
-## Open Source Only For Specific Tasks
-
-- Changing a namespace command → the one file in `src/namespaces/<name>.ts`.
-- Transport / auth / retries / streaming / binary → `src/lib/client.ts`.
-- New public type or root shortcut → `src/index.ts`.
-- Env / gateway resolution → `src/lib/config.ts`.
-- Error classification → `src/lib/errors.ts`.
-
-## Stale / Dangerous
-
-- `docs/architecture.md` §10 and `CLAUDE.md` Validation note previously said "no
-  committed automated tests". STALE — `tests/` has 24 files run by `npm test`.
-  Corrected in this pass; if you see the old claim re-appear, fix it.
-- `dist/` is generated build output (gitignored). Never use it for design
-  decisions or treat it as source.
-
-## Related Surfaces
-
-- Janitor cleanup audit:
-  `docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md`.
-- No `docs/atlas/` exists yet; run `kyle-atlas` if truth scatters.
+# 00 Reading Order
+
+Snapshot: 2026-06-27-0849-sdk-orient. Source-backed at SDK v6.6.0, branch
+`production`. Code is authority; this guide is a map.
+
+## Read These First (docs)
+
+1. This pack, in INDEX order.
+2. `docs/architecture.md` — request lifecycle, layering, Two-Layer Storage Rule.
+3. `docs/routes-services.md` — service/endpoint matrix and route-prefix mapping.
+4. `docs/usage-reference.md` — exhaustive per-command reference (large; grep it,
+   do not read top-to-bottom).
+5. `CLAUDE.md` — repo conventions and the public-API change checklist.
+
+## Open Source Only For Specific Tasks
+
+- Changing a namespace command → the one file in `src/namespaces/<name>.ts`.
+- Transport / auth / retries / streaming / binary → `src/lib/client.ts`.
+- New public type or root shortcut → `src/index.ts`.
+- Env / gateway resolution → `src/lib/config.ts`.
+- Error classification → `src/lib/errors.ts`.
+
+## Stale / Dangerous
+
+- `docs/architecture.md` §10 and `CLAUDE.md` Validation note previously said "no
+  committed automated tests". STALE — `tests/` has 24 files run by `npm test`.
+  Corrected in this pass; if you see the old claim re-appear, fix it.
+- `dist/` is generated build output (gitignored). Never use it for design
+  decisions or treat it as source.
+
+## Related Surfaces
+
+- Janitor cleanup audit:
+  `docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md`.
+- No `docs/atlas/` exists yet; run `kyle-atlas` if truth scatters.

package/docs/agent-guide/2026-06-27-0849-sdk-orient/01-purpose-and-boundaries.md

@@ -1,48 +1,48 @@
-# 01 Purpose And Boundaries
-
-## Purpose
-
-`dominus-sdk-nodejs` is the TypeScript/ESM client SDK for the Dominus
-gateway-first platform (`package.json` `description`). It exposes a singleton
-`dominus` (`src/index.ts`) with namespace-based APIs for auth, data, storage,
-AI/runtime, workflow execution, jobs, and platform administration. Application
-code uses this SDK rather than calling gateway routes directly.
-
-## What This Repo Owns
-
-- The public client surface: namespaces (`src/namespaces/*.ts`), root shortcuts,
-  and exported types/utilities (`src/index.ts`).
-- The request/transport contract: base64 wire protocol, JWT mint+cache, retries,
-  circuit breaker, SSE streaming, binary upload/download (`src/lib/client.ts`).
-- Ergonomic parameter normalization and the mapping from SDK calls to `/api/*`
-  routes that the gateway transforms to `/svc/*`.
-
-## What It Does Not Own
-
-- Backend behavior or route definitions — those live in the individual Dominus
-  workers (gateway, guardian, authority, workflow-manager, agent-runtime, etc.).
-  This SDK only describes how to call them.
-- Kernel contracts (identity families, error envelope, deployment lanes). It
-  must conform to them, not define them.
-
-## Dominus/CareBridge Boundary
-
-This is a Dominus platform repo (`dominus_active/`). It is product-agnostic: it
-carries the platform client, not CareBridge product logic. Per workspace policy,
-project↔gateway calls use this SDK with project identity; never forward user or
-machine JWTs to admin-only planes.
-
-## Runtime / Deployment Class
-
-- Published npm library (`name: dominus-sdk-nodejs`), single export entry
-  (`dist/index.js` / `dist/index.d.ts`); no subpath exports.
-- ESM only (`"type": "module"`), Node `>=18` (`engines`).
-- Released by pushing to the `production` branch (npm publish). Per workspace
-  convention this repo's production branch is `production`, NOT
-  `dominus-production`.
-
-## PHI / Secrets / Safety
-
-- Service auth is a PSK in `DOMINUS_TOKEN`, exchanged for a short-lived JWT.
-- Never write PHI, secrets, tokens, cookies, or raw response bodies into these
-  docs or into logs.
+# 01 Purpose And Boundaries
+
+## Purpose
+
+`dominus-sdk-nodejs` is the TypeScript/ESM client SDK for the Dominus
+gateway-first platform (`package.json` `description`). It exposes a singleton
+`dominus` (`src/index.ts`) with namespace-based APIs for auth, data, storage,
+AI/runtime, workflow execution, jobs, and platform administration. Application
+code uses this SDK rather than calling gateway routes directly.
+
+## What This Repo Owns
+
+- The public client surface: namespaces (`src/namespaces/*.ts`), root shortcuts,
+  and exported types/utilities (`src/index.ts`).
+- The request/transport contract: base64 wire protocol, JWT mint+cache, retries,
+  circuit breaker, SSE streaming, binary upload/download (`src/lib/client.ts`).
+- Ergonomic parameter normalization and the mapping from SDK calls to `/api/*`
+  routes that the gateway transforms to `/svc/*`.
+
+## What It Does Not Own
+
+- Backend behavior or route definitions — those live in the individual Dominus
+  workers (gateway, guardian, authority, workflow-manager, agent-runtime, etc.).
+  This SDK only describes how to call them.
+- Kernel contracts (identity families, error envelope, deployment lanes). It
+  must conform to them, not define them.
+
+## Dominus/CareBridge Boundary
+
+This is a Dominus platform repo (`dominus_active/`). It is product-agnostic: it
+carries the platform client, not CareBridge product logic. Per workspace policy,
+project↔gateway calls use this SDK with project identity; never forward user or
+machine JWTs to admin-only planes.
+
+## Runtime / Deployment Class
+
+- Published npm library (`name: dominus-sdk-nodejs`), single export entry
+  (`dist/index.js` / `dist/index.d.ts`); no subpath exports.
+- ESM only (`"type": "module"`), Node `>=18` (`engines`).
+- Released by pushing to the `production` branch (npm publish). Per workspace
+  convention this repo's production branch is `production`, NOT
+  `dominus-production`.
+
+## PHI / Secrets / Safety
+
+- Service auth is a PSK in `DOMINUS_TOKEN`, exchanged for a short-lived JWT.
+- Never write PHI, secrets, tokens, cookies, or raw response bodies into these
+  docs or into logs.

package/docs/agent-guide/2026-06-27-0849-sdk-orient/02-repo-map-and-entrypoints.md

@@ -1,46 +1,46 @@
-# 02 Repo Map And Entrypoints
-
-## Directory Map
-
-| Path | Purpose |
-|---|---|
-| `src/index.ts` | Singleton construction, 27 namespace wiring, root shortcuts, public type/util re-exports. |
-| `src/lib/client.ts` | Transport: base64 wire protocol, JWT mint/cache, retries, circuit breaker, SSE, binary IO. |
-| `src/lib/cache.ts` | Encrypted in-memory cache + circuit breaker primitives. |
-| `src/lib/config.ts` | Env/config resolution (gateway/proxy). |
-| `src/lib/errors.ts` | Typed SDK error hierarchy. |
-| `src/lib/console-capture.ts` | Optional console forwarding to the logs namespace. |
-| `src/lib/page-rules.ts`, `src/lib/user-session.ts` | Portal JWT / page-access local caches. |
-| `src/lib/crypto.ts`, `schema-builder.ts`, `trace.ts`, `conversation-format.ts` | Helpers (crypto, schema-builder normalization, trace, conversation format). |
-| `src/namespaces/*.ts` | One file per namespace (27 files). |
-| `src/contracts/versioned-storage.ts` | Versioned-storage contract types. |
-| `tests/` | 24 test files (`.test.js`, `.test.ts`, `.typecheck.ts`). |
-| `docs/` | `architecture.md`, `routes-services.md`, `usage-reference.md`, `workflow-hard-cut-release.md`, plus this `agent-guide/` and `janitor/`. |
-| `.github/workflows/` | npm publish workflows by branch (dev/staging/production). |
-| `dist/` | Generated build output (gitignored). Not source. |
-| `node_modules/` | Installed deps (gitignored). |
-
-## Main Entrypoints
-
-- Public API: import `{ dominus }` from `dominus-sdk-nodejs` (resolves to
-  `dist/index.js`; source is `src/index.ts`).
-- Source-of-truth surface: `src/index.ts` constructor wires each
-  `public readonly <name>` namespace; a second wiring block builds a
-  token-scoped client subset.
-
-## Test Entrypoints
-
-- `npm test` builds, runs type tests, then runs the explicit node:test file list
-  in `package.json` `scripts.test`.
-- `npm run test:types` runs `tsc -p tsconfig.type-tests.json` for the
-  `*.typecheck.ts` files.
-
-## Config / Build / Deploy Entrypoints
-
-- `tsconfig.json` (build), `tsconfig.type-tests.json` (type tests).
-- `npm run build` (`tsc`) → `dist/`.
-- `.github/workflows/publish-production.yml` on push to `production`.
-
-## Avoid
-
-- `dist/` and `node_modules/` — generated; never edit, never cite as source.
+# 02 Repo Map And Entrypoints
+
+## Directory Map
+
+| Path | Purpose |
+|---|---|
+| `src/index.ts` | Singleton construction, 27 namespace wiring, root shortcuts, public type/util re-exports. |
+| `src/lib/client.ts` | Transport: base64 wire protocol, JWT mint/cache, retries, circuit breaker, SSE, binary IO. |
+| `src/lib/cache.ts` | Encrypted in-memory cache + circuit breaker primitives. |
+| `src/lib/config.ts` | Env/config resolution (gateway/proxy). |
+| `src/lib/errors.ts` | Typed SDK error hierarchy. |
+| `src/lib/console-capture.ts` | Optional console forwarding to the logs namespace. |
+| `src/lib/page-rules.ts`, `src/lib/user-session.ts` | Portal JWT / page-access local caches. |
+| `src/lib/crypto.ts`, `schema-builder.ts`, `trace.ts`, `conversation-format.ts` | Helpers (crypto, schema-builder normalization, trace, conversation format). |
+| `src/namespaces/*.ts` | One file per namespace (27 files). |
+| `src/contracts/versioned-storage.ts` | Versioned-storage contract types. |
+| `tests/` | 24 test files (`.test.js`, `.test.ts`, `.typecheck.ts`). |
+| `docs/` | `architecture.md`, `routes-services.md`, `usage-reference.md`, `workflow-hard-cut-release.md`, plus this `agent-guide/` and `janitor/`. |
+| `.github/workflows/` | npm publish workflows by branch (dev/staging/production). |
+| `dist/` | Generated build output (gitignored). Not source. |
+| `node_modules/` | Installed deps (gitignored). |
+
+## Main Entrypoints
+
+- Public API: import `{ dominus }` from `dominus-sdk-nodejs` (resolves to
+  `dist/index.js`; source is `src/index.ts`).
+- Source-of-truth surface: `src/index.ts` constructor wires each
+  `public readonly <name>` namespace; a second wiring block builds a
+  token-scoped client subset.
+
+## Test Entrypoints
+
+- `npm test` builds, runs type tests, then runs the explicit node:test file list
+  in `package.json` `scripts.test`.
+- `npm run test:types` runs `tsc -p tsconfig.type-tests.json` for the
+  `*.typecheck.ts` files.
+
+## Config / Build / Deploy Entrypoints
+
+- `tsconfig.json` (build), `tsconfig.type-tests.json` (type tests).
+- `npm run build` (`tsc`) → `dist/`.
+- `.github/workflows/publish-production.yml` on push to `production`.
+
+## Avoid
+
+- `dist/` and `node_modules/` — generated; never edit, never cite as source.

package/docs/agent-guide/2026-06-27-0849-sdk-orient/03-api-surface.md

@@ -1,59 +1,59 @@
-# 03 API Surface
-
-The public surface is the `dominus` singleton (`src/index.ts`). Each namespace is
-a `public readonly` property backed by one file in `src/namespaces/`. The
-authoritative, exhaustive per-command reference is `docs/usage-reference.md`;
-the service/endpoint matrix is `docs/routes-services.md`. This page is the map.
-
-## Namespaces (27, wired in `src/index.ts`)
-
-| Namespace | File | Backend / role (see routes-services.md) |
-|---|---|---|
-| `dominus.secrets` | `secrets.ts` | warden (selected-scope grants). |
-| `dominus.db` | `db.ts` | db-worker. |
-| `dominus.secure` | `secure.ts` | scribe (audited secure-table access). |
-| `dominus.redis` | `redis.ts` | redis-worker (ephemera building block). |
-| `dominus.files` | `files.ts` | b2-worker / admin-worker. |
-| `dominus.auth` | `auth.ts` | guardian + local JWT helpers. |
-| `dominus.ddl` | `ddl.ts` | smith / db-worker (schema builder + provisioning). |
-| `dominus.logs` | `logs.ts` | logs-worker (tail supports `machine_id`). |
-| `dominus.portal` | `portal.ts` | portal-worker. |
-| `dominus.courier` | `courier.ts` | courier-worker. |
-| `dominus.health` | `health.ts` | gateway-local (`/health`, `/v1/ping`). |
-| `dominus.admin` | `admin.ts` | admin-worker. |
-| `dominus.ai` (+ `.rag`, `.tools`, `.workflow`, `.results`, `.artifacts`) | `ai.ts` | agent-runtime. |
-| `dominus.workflow` | `workflow.ts` | workflow-manager (`ensure()` is the public launch path). |
-| `dominus.sync` | `sync.ts` | sync-worker. |
-| `dominus.jobs` | `jobs.ts` | job-worker. |
-| `dominus.processor` | `processor.ts` | processor-service. |
-| `dominus.artifacts` | `artifacts.ts` | artifact-worker (Artifact V2 `ar://`). |
-| `dominus.authority` | `authority.ts` | authority (app/org/env cutover surface). |
-| `dominus.browser` | `browser.ts` | browser-worker via `/svc/browser/*`. |
-| `dominus.deployer` | `deployer.ts` | deploy surface. |
-| `dominus.warden` | `warden.ts` | warden. |
-| `dominus.stash` | `stash.ts` | **primary storage surface** (kind registry routes to backend). |
-| `dominus.recipes` | `recipes.ts` | recipe-worker. |
-| `dominus.platform` | `platform.ts` | platform-worker via `/svc/platform/*`. |
-| `dominus.coder` | `coder.ts` | coder-runtime via `/svc/coder/*`. |
-| `dominus.publisher` | `publisher.ts` | publisher. |
-
-(`ai` sub-namespaces and `auth` local helpers are extra surfaces beyond the 27
-top-level files; see routes-services.md for the full service matrix.)
-
-## Root Shortcuts And Utilities
-
-- Root shortcuts on the singleton: `get`, `upsert`, `listTables`, `queryTable`,
-  `insertRow`, `addTable`, etc. (`src/index.ts`).
-- Exported utilities/types: error classes, crypto helpers
-  (`hashPassword`, `hashPsk`, `generateToken`), cache utilities, JWT helpers
-  (`verifyJwtLocally`, `isJwtValid`, `mintSelectedScopeJwt`),
-  `normalizeSchemaBuilderMigration`, console-capture controls.
-
-## Auth / Scope Per Call
-
-- Default: service JWT minted from `DOMINUS_TOKEN` PSK via `/jwt/mint`, cached
-  55 min (`JWT_CACHE_TTL = 3300000`) vs the worker's 1h `JWT_EXPIRY_SECONDS`.
-- Optional `userToken` passes a caller JWT through unchanged where backend
-  semantics require user context.
-- `mintSelectedScopeJwt(targetOrgId, targetEnv)` is the canonical selected-scope
-  mint helper.
+# 03 API Surface
+
+The public surface is the `dominus` singleton (`src/index.ts`). Each namespace is
+a `public readonly` property backed by one file in `src/namespaces/`. The
+authoritative, exhaustive per-command reference is `docs/usage-reference.md`;
+the service/endpoint matrix is `docs/routes-services.md`. This page is the map.
+
+## Namespaces (27, wired in `src/index.ts`)
+
+| Namespace | File | Backend / role (see routes-services.md) |
+|---|---|---|
+| `dominus.secrets` | `secrets.ts` | warden (selected-scope grants). |
+| `dominus.db` | `db.ts` | db-worker. |
+| `dominus.secure` | `secure.ts` | scribe (audited secure-table access). |
+| `dominus.redis` | `redis.ts` | redis-worker (ephemera building block). |
+| `dominus.files` | `files.ts` | b2-worker / admin-worker. |
+| `dominus.auth` | `auth.ts` | guardian + local JWT helpers. |
+| `dominus.ddl` | `ddl.ts` | smith / db-worker (schema builder + provisioning). |
+| `dominus.logs` | `logs.ts` | logs-worker (tail supports `machine_id`). |
+| `dominus.portal` | `portal.ts` | portal-worker. |
+| `dominus.courier` | `courier.ts` | courier-worker. |
+| `dominus.health` | `health.ts` | gateway-local (`/health`, `/v1/ping`). |
+| `dominus.admin` | `admin.ts` | admin-worker. |
+| `dominus.ai` (+ `.rag`, `.tools`, `.workflow`, `.results`, `.artifacts`) | `ai.ts` | agent-runtime. |
+| `dominus.workflow` | `workflow.ts` | workflow-manager (`ensure()` is the public launch path). |
+| `dominus.sync` | `sync.ts` | sync-worker. |
+| `dominus.jobs` | `jobs.ts` | job-worker. |
+| `dominus.processor` | `processor.ts` | processor-service. |
+| `dominus.artifacts` | `artifacts.ts` | artifact-worker (Artifact V2 `ar://`). |
+| `dominus.authority` | `authority.ts` | authority (app/org/env cutover surface). |
+| `dominus.browser` | `browser.ts` | browser-worker via `/svc/browser/*`. |
+| `dominus.deployer` | `deployer.ts` | deploy surface. |
+| `dominus.warden` | `warden.ts` | warden. |
+| `dominus.stash` | `stash.ts` | **primary storage surface** (kind registry routes to backend). |
+| `dominus.recipes` | `recipes.ts` | recipe-worker. |
+| `dominus.platform` | `platform.ts` | platform-worker via `/svc/platform/*`. |
+| `dominus.coder` | `coder.ts` | coder-runtime via `/svc/coder/*`. |
+| `dominus.publisher` | `publisher.ts` | publisher. |
+
+(`ai` sub-namespaces and `auth` local helpers are extra surfaces beyond the 27
+top-level files; see routes-services.md for the full service matrix.)
+
+## Root Shortcuts And Utilities
+
+- Root shortcuts on the singleton: `get`, `upsert`, `listTables`, `queryTable`,
+  `insertRow`, `addTable`, etc. (`src/index.ts`).
+- Exported utilities/types: error classes, crypto helpers
+  (`hashPassword`, `hashPsk`, `generateToken`), cache utilities, JWT helpers
+  (`verifyJwtLocally`, `isJwtValid`, `mintSelectedScopeJwt`),
+  `normalizeSchemaBuilderMigration`, console-capture controls.
+
+## Auth / Scope Per Call
+
+- Default: service JWT minted from `DOMINUS_TOKEN` PSK via `/jwt/mint`, cached
+  55 min (`JWT_CACHE_TTL = 3300000`) vs the worker's 1h `JWT_EXPIRY_SECONDS`.
+- Optional `userToken` passes a caller JWT through unchanged where backend
+  semantics require user context.
+- `mintSelectedScopeJwt(targetOrgId, targetEnv)` is the canonical selected-scope
+  mint helper.

package/docs/agent-guide/2026-06-27-0849-sdk-orient/04-data-state-and-storage.md

@@ -1,36 +1,36 @@
-# 04 Data, State, And Storage
-
-This SDK is a stateless client; it does not own backend storage. It exposes
-storage-facing namespaces and keeps a few in-process caches. Backends own the
-durable state.
-
-## Storage Surfaces (client-facing)
-
-Per `docs/architecture.md` §2a (Two-Layer Storage Rule):
-
-| Surface | Namespace | Role |
-|---|---|---|
-| Named, durable data of a registered kind | `dominus.stash.*` | **Primary** — kind registry routes to the right backend + policy. |
-| Direct `ar://`-addressed Artifact V2 workflow | `dominus.artifacts.*` | Escape hatch when you already hold a canonical ref. |
-| Locks, queues, counters, short-lived cache | `dominus.redis.*` | Ephemera building block. |
-| Tables / SQL | `dominus.db.*`, `dominus.ddl.*` | db-worker / smith building blocks. |
-| Object/file storage | `dominus.files.*` | b2-worker building block. |
-| New kernel backend / documented fallback | primitives | Lowest layer only. |
-
-Rule: application data → Stash. Primitives only for ephemera or when building a
-kernel backend.
-
-## In-Process Client State (this repo)
-
-- **Service JWT cache** — `src/lib/client.ts`, cached 55 min, refreshed via
-  `ensureValidJwt` mutex to avoid thundering herd.
-- **Encrypted in-memory cache** — `src/lib/cache.ts`; encryption key seeded from
-  `DOMINUS_TOKEN` in `src/index.ts`.
-- **Portal/session caches** — `src/lib/page-rules.ts`, `src/lib/user-session.ts`
-  for portal JWT / page-access acceleration.
-- **JWKS cache** — `auth.getJwks` caches public signing keys.
-
-## Migrations
-
-- None in this repo. Schema/migration helpers (`ddl`, `normalizeSchemaBuilderMigration`)
-  build requests for the db/smith workers; the migrations themselves run there.
+# 04 Data, State, And Storage
+
+This SDK is a stateless client; it does not own backend storage. It exposes
+storage-facing namespaces and keeps a few in-process caches. Backends own the
+durable state.
+
+## Storage Surfaces (client-facing)
+
+Per `docs/architecture.md` §2a (Two-Layer Storage Rule):
+
+| Surface | Namespace | Role |
+|---|---|---|
+| Named, durable data of a registered kind | `dominus.stash.*` | **Primary** — kind registry routes to the right backend + policy. |
+| Direct `ar://`-addressed Artifact V2 workflow | `dominus.artifacts.*` | Escape hatch when you already hold a canonical ref. |
+| Locks, queues, counters, short-lived cache | `dominus.redis.*` | Ephemera building block. |
+| Tables / SQL | `dominus.db.*`, `dominus.ddl.*` | db-worker / smith building blocks. |
+| Object/file storage | `dominus.files.*` | b2-worker building block. |
+| New kernel backend / documented fallback | primitives | Lowest layer only. |
+
+Rule: application data → Stash. Primitives only for ephemera or when building a
+kernel backend.
+
+## In-Process Client State (this repo)
+
+- **Service JWT cache** — `src/lib/client.ts`, cached 55 min, refreshed via
+  `ensureValidJwt` mutex to avoid thundering herd.
+- **Encrypted in-memory cache** — `src/lib/cache.ts`; encryption key seeded from
+  `DOMINUS_TOKEN` in `src/index.ts`.
+- **Portal/session caches** — `src/lib/page-rules.ts`, `src/lib/user-session.ts`
+  for portal JWT / page-access acceleration.
+- **JWKS cache** — `auth.getJwks` caches public signing keys.
+
+## Migrations
+
+- None in this repo. Schema/migration helpers (`ddl`, `normalizeSchemaBuilderMigration`)
+  build requests for the db/smith workers; the migrations themselves run there.

package/docs/agent-guide/2026-06-27-0849-sdk-orient/05-integrations-and-runtime.md

@@ -1,40 +1,40 @@
-# 05 Integrations And Runtime
-
-## External Dependencies
-
-- Runtime deps (`package.json`): `jose` (JWT verify/mint helpers), `bcryptjs`
-  (password/PSK hashing).
-- Dev deps: `typescript`, `@types/node`, `@types/bcryptjs`.
-
-## Cross-Repo / Gateway Calls
-
-The SDK is a client to the Dominus gateway. Namespace code targets `/api/*`
-paths; when a method sets `useGateway: true` the client transforms `/api/*` to
-gateway `/svc/*` dispatch paths (`docs/architecture.md` §4,
-`docs/routes-services.md`). Backends reached include guardian, authority,
-workflow-manager, agent-runtime, db/redis/b2/logs workers, platform-worker,
-coder-runtime, browser-worker, and others — see the service matrix in
-`docs/routes-services.md`.
-
-Notable routing facts (from `CLAUDE.md` / routes-services.md):
-
-- `dominus.browser.*` must use `/api/browser/*` with `useGateway: true`
-  (gateway exposes `/svc/browser/*`); do not point at worker-local `/runs/*`.
-- `dominus.platform.*` and `dominus.coder.*` call `/svc/*` via `gatewayFetch`
-  and forward `X-Actor-Type` / `X-Actor-Id`.
-- `dominus.coder.ensureRun()` requires exactly one of `workflowRecipeRef` or
-  `pipelineRecipeRef`.
-- `dominus.ai.stt` → `POST /api/agent/stt` (batch; legacy WebSocket STT retired).
-
-## Runtime Assumptions
-
-- ESM only (`"type": "module"`), Node `>=18`.
-- Single published entry point; import from `'dominus-sdk-nodejs'` only.
-
-## Environment Variables (by category, no values)
-
-- **Auth:** `DOMINUS_TOKEN` (PSK; also seeds the in-memory cache encryption key).
-- **Gateway/config:** resolved in `src/lib/config.ts` (gateway base URL / proxy
-  config). Read that file for the exact variable names before relying on one.
-
-Never write secret values into docs or logs.
+# 05 Integrations And Runtime
+
+## External Dependencies
+
+- Runtime deps (`package.json`): `jose` (JWT verify/mint helpers), `bcryptjs`
+  (password/PSK hashing).
+- Dev deps: `typescript`, `@types/node`, `@types/bcryptjs`.
+
+## Cross-Repo / Gateway Calls
+
+The SDK is a client to the Dominus gateway. Namespace code targets `/api/*`
+paths; when a method sets `useGateway: true` the client transforms `/api/*` to
+gateway `/svc/*` dispatch paths (`docs/architecture.md` §4,
+`docs/routes-services.md`). Backends reached include guardian, authority,
+workflow-manager, agent-runtime, db/redis/b2/logs workers, platform-worker,
+coder-runtime, browser-worker, and others — see the service matrix in
+`docs/routes-services.md`.
+
+Notable routing facts (from `CLAUDE.md` / routes-services.md):
+
+- `dominus.browser.*` must use `/api/browser/*` with `useGateway: true`
+  (gateway exposes `/svc/browser/*`); do not point at worker-local `/runs/*`.
+- `dominus.platform.*` and `dominus.coder.*` call `/svc/*` via `gatewayFetch`
+  and forward `X-Actor-Type` / `X-Actor-Id`.
+- `dominus.coder.ensureRun()` requires exactly one of `workflowRecipeRef` or
+  `pipelineRecipeRef`.
+- `dominus.ai.stt` → `POST /api/agent/stt` (batch; legacy WebSocket STT retired).
+
+## Runtime Assumptions
+
+- ESM only (`"type": "module"`), Node `>=18`.
+- Single published entry point; import from `'dominus-sdk-nodejs'` only.
+
+## Environment Variables (by category, no values)
+
+- **Auth:** `DOMINUS_TOKEN` (PSK; also seeds the in-memory cache encryption key).
+- **Gateway/config:** resolved in `src/lib/config.ts` (gateway base URL / proxy
+  config). Read that file for the exact variable names before relying on one.
+
+Never write secret values into docs or logs.